Your role vs the owner's

The law gives duties to whoever holds and controls the data and the money. Casa Crown holds only the enquiry. The owner holds the stay.

Key dates

Most of the rules on this page are already law. The new data protection law comes in steps.

Business registration

The basic paperwork every small service business in Maharashtra needs.

GST & income tax

Your income is commission and marketing fees. Both are services.

• GST registration above ₹20 lakh a year Must

  Once your total yearly income from all services crosses ₹20 lakh, register for GST and charge 18% GST on your commission and marketing fees. Give every owner a proper tax invoice.

• Think about registering early Tip

  Meta and Google charge GST on your ad spend. If you are registered, you can claim that GST back (input tax credit). Ask your CA if this saves you money.

• Keep proper accounts Must

  Commission income cannot use the simple "presumptive" tax scheme that many small businesses use. You need proper books: income, expenses (ad spend, staff, travel) and invoices. A tax audit is needed if turnover crosses ₹1 crore (₹10 crore if almost all receipts are digital).

• TDS on your commission Know this

  Some owners, such as companies or those whose own accounts are audited, must cut 2% TDS from commission over ₹20,000 a year. Collect their TDS certificates; the tax is credited back to you when you file your return. (Section numbers changed under the new Income-tax Act, 2025; your CA will use the new ones.)

• File on time Must

  GST returns monthly or quarterly once registered, income tax return every year, and advance tax if your tax is above ₹10,000.

Data protection law (DPDP)

The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. For your enquiry data, Casa Crown is the "data fiduciary": you decide what to collect and why, so the duties are yours.

• 1. Give a clear notice Must

  Before or when you collect details, tell people in plain words: what you collect, why, who you share it with (the villa owner), how long you keep it, and how to contact you. See the ready-made text.

• 2. Get consent Must

  Use a tick box that is not pre-ticked. Keep a record of when and how each person agreed. Marketing messages need a separate tick box.

• 3. Make it easy to say no later Must

  Withdrawing consent must be as easy as giving it, for example "Reply STOP" or a WhatsApp message. When someone withdraws, stop using their data and tell the owner you shared it with.

• 4. Collect only what you need Must

  Name, phone, dates, number of guests and budget are enough. No ID cards, no addresses, no photos of people at the enquiry stage.

• 5. Use it only for the reason you gave Must

  A lead for one villa can go to that villa's owner. Sending it to other owners, adding it to a sales list, or selling it needs the person's agreement first.

• 6. Respect people's rights Must

  Anyone can ask to see, correct or delete their data, or name someone to act for them. Publish a contact (WhatsApp number or email) for these requests and answer within 90 days.

• 7. No data from children Must

  Under 18 counts as a child. Don't take enquiries from minors and don't target ads at them. If a minor contacts you, ask for a parent.

• 8. Contracts with anyone who handles leads for you Must

  A freelancer who filters leads, a call centre or a software tool handles data on your behalf. You stay responsible for them, so have a written agreement that they keep it safe and secret.

• 9. Owner data in your dashboard Know this

  If you keep an owner's bookings or guest details in your own dashboard or app, you are handling that data for the owner. Add a short data clause to the owner agreement saying you keep it safe, use it only for them, and delete or return it when they leave.

Lead form notice: ready to use

Put this on every lead form, landing page and the first WhatsApp auto-reply. Fill in the blanks and have your lawyer check it.

Keeping data safe

The law asks for "reasonable security". For a small team, that means these habits.

• Two-step login everywhere

  Turn it on for WhatsApp, Meta Business, Google and your dashboard. Use a password manager and never share one login among staff.

• One place for leads

  Keep leads in one secure system, not spread across personal phones, screenshots and open spreadsheets.

• Only the people who need it

  Staff see only the leads they work on. Remove access on the day someone leaves.

• Send each lead only to its owner

  No big WhatsApp groups with many owners, and no shared sheets anyone can open.

• Keep access logs

  Record who opened, changed or sent each lead. The DPDP Rules ask you to keep these logs for 1 year, and CERT-In asks for system logs for 180 days.

• Back up

  Keep a backup so a lost phone or a hacked account doesn't wipe your records.

How long to keep records

Delete data once its purpose is over, unless a law says to keep it. Set reminders (or auto-delete) so this actually happens.

If data leaks

For example: a staff phone is stolen, a WhatsApp or Meta account is hacked, or a lead sheet is shared publicly by mistake.

1. Stop it. Change passwords, log out all devices, remove public links, lock the account.
2. Report to CERT-In within 6 hours if it is a cyber incident such as hacking or a data leak (cert-in.org.in).
3. Tell the Data Protection Board without delay, then send a full report within 72 hours: what happened, what data, how many people, what you did about it.
4. Tell each affected person in simple words: what happened, what it means for them, what you've done, what they should do (for example, watch for fake calls), and who to contact.
5. Tell the owners whose leads were affected.
6. Write it down and fix the cause so it doesn't happen again.

Advertising rules

The Consumer Protection Act, 2019 holds the advertiser responsible for false or misleading ads, even if the owner gave you the details.

• Real, current photos and videos Must

  Only show what the guest will get. AI-made or heavily edited pictures must not change the villa (no fake pools, views or room counts). Label concept images clearly.

• Honest prices Must

  Show the full price, or clearly say what's extra (GST, cleaning, extra guests). No "from ₹2,999" if almost nothing is at that price.

• No fake urgency or tricks Must

  The government's 2023 dark-pattern rules ban false "Only 1 villa left!" or fake countdowns, hidden charges added later (drip pricing), and bait-and-switch (advertising one villa, then pushing another).

• No fake reviews Must

  Never post or buy reviews. Use only real guest reviews, with their permission.

• Influencers must say it is paid Must

  If you pay or gift a stay to an influencer, their post must clearly say "Ad", "Sponsored" or "Collaboration".

• Permission for faces and music Must

  Get written permission before showing guests, staff or the owner's family in an ad. Use licensed music only; copyrighted songs can get the ad or account taken down.

• Follow Meta and Google ad policies Must

  Lead ads need a privacy policy link. Breaking platform rules can get the ad account banned, which would stop the business overnight.

Calls, SMS & WhatsApp

TRAI's rules against spam calls are strict and now enforced: phone numbers get disconnected.

Owner agreement

Sign one with every villa owner before you start. It is what keeps the stay-related liability with the owner. Have a lawyer turn these points into a contract.

1. Your role. Casa Crown is a marketing and lead agent only. The owner is the host; the booking contract is between the owner and the guest.
2. Fees. The commission % or monthly fee, when it is earned (confirmed booking or check-in), what happens if the guest cancels, invoices with GST, and TDS if it applies.
3. No bypassing. A guest you send stays "your lead" for a set time (for example 12 months). Commission is due even if they book again directly.
4. Guest data. From the moment a lead is forwarded, the owner is responsible for it. The owner won't sell it, spam it or share it, will follow data protection rules, and will tell you about any leak.
5. Owner's promises. The villa has all licences and permissions, is safe, matches the photos and details given to you, and honours the prices you advertise.
6. Who pays for what goes wrong (indemnity). The owner covers claims about the stay (injury, theft, refunds, police issues). You cover claims about your ads. Put a cap on your liability (for example, fees received in the last 3 months).
7. Content and accounts. Who owns the photos and videos you shoot. Permission to use the owner's social media and ad accounts, and that you'll keep those logins safe.
8. Ending the agreement. The notice period, final payments, and returning or deleting each other's data.
9. Disputes. Talk first, then arbitration or courts in a fixed place (for example Raigad or Mumbai).

What villas must have

These are the owner's legal duties, not yours. But if you advertise a villa that breaks them and something goes wrong, your name is on the ad. Ask every owner to confirm these in writing.

What to tell guests

Make your role clear everywhere a guest sees your name: website, ads, WhatsApp auto-reply and the booking confirmation message.

Guest payments: keep out of them

Guests should pay the owner directly: UPI, bank transfer or the owner's payment link.

Fines

These are maximum amounts. Actual fines depend on how serious the problem is, the size of the business, and how quickly you fixed it.

Checklist

Tick items as you finish them. Ticks are saved in this browser only.

Business plan: earn as the agent

How Casa Crown keeps its profitable services while carrying the least legal risk. The rule behind every choice below: sell services to owners and guests, but never become the one who runs the villa or holds the guest's money.

Revenue lines: profit vs risk

Every way Casa Crown earns today, ranked. Keep the low-risk lines as the base; treat the rest as extras with conditions.

How money should move

The single biggest way to cut risk. Phase 1 is the plan; Phase 2 is only an option for later.

• Phase 1: guests pay the owner directly Do this

  Advance and balance go to the owner's UPI, bank account or the owner's own payment link. Casa Crown sends the owner a monthly commission invoice for the bookings it brought, matched against the dashboard's booking register.

• Owner statement, not payout Tip

  The owner's monthly report shows the bookings Casa Crown brought, the commission due and the marketing fee. Casa Crown never "owes" the owner the stay money, because it never received it.

• Phase 2 (optional): split payments Later

  If online payment through Casa Crown's pages becomes important, a split-payment setup can send the stay amount straight to the owner's account and only the commission to Casa Crown. Even then, GST rules for e-commerce operators (paying GST on the room rent, collecting TCS) and TDS may apply. Get a CA's written view first.

• Security deposits stay with the owner Must

  Deposits are collected and refunded by the owner. Casa Crown only records the amount and the outcome.

Rules for each service

Small habits that keep each money-making service on the safe side.

• Marketing Must

  Real photos of the actual villa, prices including taxes, no fake "only 1 left". Keep the owner's approval for every post. Use licensed or platform-provided music in reels.

• Drone shoots Must

  Only a registered drone flown by a certified pilot, after checking the zone map on Digital Sky. Easiest: hire a licensed drone operator who carries the risk.

• People in videos Recommended

  A short signed release from anyone recognisable (staff, models, guests), and a written note of who owns the footage: Casa Crown or the owner.

• Pickups and drops Must

  Only list cab operators with commercial (yellow-plate) permits and insurance. Never arrange private cars for hire.

• Food, cakes and private chefs Must

  Every food supplier has its own FSSAI registration. Their name is on the quote and receipt.

• Parties and events Must

  Permissions, noise limits and liquor permits are the guest's and owner's job. Casa Crown never buys, sells or arranges alcohol or liquor permits.

• Guest ID cards Never

  Casa Crown doesn't collect or store guest IDs. Keep the dashboard's ID-upload idea switched off; the owner checks IDs at check-in.

• Credits and referrals Must

  Written terms: discount only, no cash value, not transferable, expires in 12 months, can be withdrawn for misuse. Referral reward is given after the friend's stay, not at booking.

• Vendor checks Recommended

  Keep the "licence checked" date, insurance proof and guest ratings for every listed vendor. It shows you chose vendors with care if something goes wrong.

Other contracts you need

The owner agreement comes first. These cover everyone else Casa Crown deals with.

Insurance

Contracts move the risk; insurance pays when something still goes wrong. Ask a broker for quotes. For a small agency these policies are usually affordable.

Pricing to test

Starting points, not final prices. Adjust after the first 3 to 5 owners.

Launch steps

In this order. Each step protects the next.

1. Form an LLP or private limited company. Protects personal assets; keep a separate company for anything riskier later.
2. Contracts. Owner agreement, guest terms, vendor agreement, software terms and privacy policy written by a lawyer.
3. CA review. GST registration timing, SAC codes for each service, TDS on commission, and a written view before any online guest payment.
4. Money flow. Guests pay owners directly; payment screens in the dashboard pointed at owners' accounts or switched off.
5. Insurance. Professional indemnity, general liability and cyber for Casa Crown; owners' insurance certificates on file.
6. Vendors. Licences, permits and insurance checked; names on every quote.
7. First 3 owners signed on the new agreement; demo data wiped from the dashboard.
8. Review after 3 months. Complaints, refunds, disputes and profit per line. Drop or change anything where the risk turned out bigger than the profit.

Sources

Official websites to check for the latest rules.

• MeitY: DPDP Act 2023 and DPDP Rules 2025
• CERT-In: cyber incident reporting
• CBIC and GST portal
• Income Tax Department
• Maharashtra GST: Professional Tax
• Maharashtra Labour Dept: Shop & Establishment
• Dept of Consumer Affairs: CCPA ad and dark-pattern rules
• TRAI: calling and SMS rules
• Bureau of Immigration: Form C
• FSSAI: food registration
• AZB & Partners: DPDP rollout dates
• Taxmann: DPDP obligations and penalties